4

I'm keeping my private key in .ssh/id_rsa with -rw------- permissions.

But that means every user process can steal my private key which would be disastrous, I'm not going around running random executables, but how can you be sure no one reads it, if you are not compiling everything on your own? Can you spot if Google Chrome reads it?

I feel like I should employ security by obscurity.. like storing my private key in a random place and only letting SSH know the path (again maybe compiling my own executable, otherwise the hackers can just read the config value)

How do you keep your private files safe? Especially if you are managing many servers which allow access to this key.

4

Store the key encrypted (using passphrase). Then it can be read be any process, but not used.

Or store the key on the HSM (Smart Card, Yubikey), where from it can not be read, but only used upon your confirmation.

Also SELinux as mentioned in the comments can be answer for you, which implements labeling of files and processes and prevents unauthorized access to files the process does not need.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.